Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
SAMBUMBA
pasteque-server
Commits
0ab1cabc
Commit
0ab1cabc
authored
Mar 28, 2017
by
Karamel
Browse files
Add 'allowed_origin' in config and CORS headers in api
parent
a71dbd1e
Changes
2
Hide whitespace changes
Inline
Side-by-side
api.php
View file @
0ab1cabc
...
...
@@ -53,6 +53,24 @@ if (isset($_GET[PT::URL_ACTION_PARAM])) {
$broker
=
new
APIBroker
(
$api
);
$result
=
$broker
->
run
(
$action
,
$params
);
if
(
array_key_exists
(
'allowed_origin'
,
getConfig
())
&&
array_key_exists
(
'HTTP_ORIGIN'
,
$_SERVER
))
{
// Handle CORS
$config
=
getConfig
();
$cors
=
$config
[
'allowed_origin'
];
$origin
=
$_SERVER
[
'HTTP_ORIGIN'
];
// Accept *, single value match or in array
$allowedOrigin
=
(
$cors
===
'*'
||
(
!
is_array
(
$cors
)
&&
$cors
===
$origin
)
||
(
is_array
(
$cors
)
&&
in_array
(
$origin
,
$cors
)));
if
(
$allowedOrigin
)
{
header
(
'Access-Control-Allow-Origin: '
.
$origin
);
header
(
'Access-Control-Allow-Credentials: false'
);
// Turned off for now, api should embed token in requests.
header
(
'Access-Control-Max-Age: '
.
$config
[
'jwt_timeout'
]);
if
(
is_array
(
$cors
))
{
header
(
'Vary: Origin'
);
}
}
else
{
Log
::
info
(
'Call from '
.
$origin
.
' probably rejected (CORS)'
);
}
}
if
(
$api
==
'ImagesAPI'
)
{
// Special case of images api with binary data
header
(
'Cache-Control: max-age=864000'
);
...
...
config-sample.php
View file @
0ab1cabc
...
...
@@ -52,6 +52,11 @@ $config['thumb_quality'] = 50;
$config
[
'jwt_timeout'
]
=
600
;
// Validity in seconds of an auth token
$config
[
'jwt_secret'
]
=
'Change this to a superstrong password'
;
// Allow CORS for ajax clients from other domains.
// Can be a single value like '*' (not recommended)
// or an array of hosts with protocol.
// If disabled, accepts only requests from the same domain
//$config['allowed_origin'] = ['https://my.client.com', 'https://other.domain.com'];
// Paypal config (for module payment)
$config
[
'pp_sandbox_id'
]
=
''
;
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment